As it happens I’d been meaning to post about iTunes security in any case. I blogged about an incident just over a month ago, since when there have been a steady stream of comments from other users who say that their iTunes accounts were hacked and fraudulent purchases made.

A recent comment refers to this thread, started over a year ago and now with over 200 comments from similarly afflicted users.

Despite the number of reported incidents, there is no reason to suppose that Apple’s servers have been broken into. Several other mechanisms are more likely, including malware-infected computers on which users may have stored passwords, or have keystrokes logged; or successful attempts to guess passwords or the answer to so-called “security questions” which also give access to account details.

Such questions should be called insecurity questions, since they are really designed to reduce the burden on helpdesks from users who have lost passwords or access to obsolete email accounts. Since they allow access to accounts without knowing the password, they reduce security, and even more so when the questions are for semi-public information like mother’s maiden name, which is commonly used.

Given the number of iTunes accounts, it is not surprising that there are numerous successful hacks, whether or not there is some issue (other than the insecurity questions) with iTunes or Apple’s servers.

That said, there is a consistent theme running through all these threads, which is that Apple’s customer service towards victims of hacking seems poor. Contact is email-only, users are simply referred to their banks, Apple promises further contact within 24 hours that is often not forthcoming, and there are reports of users losing access to credit or previous purchases. It was an instance of the latter which prompted my earlier post.

Apple therefore should fix its customer service, even if its servers are watertight. I’d like to see it lose the insecurity questions too.

Related posts:

1. iTunes user has account hacked, loses access to his own purchases
2. Customer complains about iTunes DRM, gets refund
3. New iPod locked more tightly to iTunes, will not work with Linux

This is where it gets really nasty. Apple closed the compromised iTunes account and de-authorised all his purchases – not only the ones the fraudster grabbed, but everything he had bought over a period of 6 years:

When I contacted Apple about what happened they were totally unhelpful. Now they seem to have closed my iTunes account entirely, and I can no longer access any of the protected AAC music files, television shows or movies that I “purchased” from iTunes in the past. They are as good as gone. iTunes customer service does not respond to my emails inquiring about how to get my account reactivated. I cannot get through to anyone via phone, I just get a message directing me to their customer service website, and I can’t really use that because as far as Apple is concerned, I don’t have an account with them anymore.

With such a clear-cut case, you would think that Bilderback would eventually recover his purchases, but he says the incident “has been going on for three months now with no resolution in sight”.

The case highlights the difference between the old world of buying physical media like a CD, which comes with a transferable licence for personal use, and the new one where you download the media and buy a licence that is more restrictive, sometimes combined with technical content protection that further limits how you can enjoy your purchase.

That said, much iTunes content is not DRM-protected so presumably Bilderback can still get access to that.

The other aspect of this story is about customer service. It is a common story: individual versus large corporate entity, and the difficulty in getting through to anyone with both the willingness to listen and the power to do anything about a problem.

I guess he could try emailing Steve Jobs? Sometimes you get a reply.

Related posts:

1. iTunes hacks: whose fault are they?
2. MySpace account hacked
3. New iPod locked more tightly to iTunes, will not work with Linux

My biggest disappointment is the price. It is a fraction cheaper than an Apple iPhone, but still far from a mass market product; though it won’t feel that way in the tech influencer community.

All this is rather unimportant; even prices will fall eventually. What matters is that attention is shifting from web+desktop (or laptop) to web+smartphone as the computing platform of the moment. That shift is far from complete; most of us still need the large screen and comfortable keyboard of a laptop to do our work. It is real though, and it is obvious that the need to carry around a bulky laptop with a short battery life is diminishing. Netbooks and Apple’s rumoured tablet are part of the same movement towards smaller, lighter and web-connected.

Although these gadgets are getting more capable, there is no sign of them following the desktop model with feature-rich local applications and heavy use of local storage. The applications being downloaded in huge numbers from Apple’s app store – a breathtaking three billion to date according to today’s announcement – are small, single-purpose apps where speed and usability is valued over richness of features, and where data comes from the Internet. This is the new model of application development.

Google’s announcement is also an important move in the identity wars. Most computer users have multiple identities: maybe an Active Directory account on a Microsoft network, a Facebook account, an Apple ID for iTunes and MobileMe, a Google account for Gmail and Google Docs. All these competing players gain hugely if they can increase the importance of your identity on their platform versus the others. If Microsoft can keep your Active Directory account at the centre of your world, then you will be a customer for Exchange, Office, SharePoint and so on. On the other hand, if your Google sign-in becomes more important, then Google’s products are correspondingly more attractive and it can sell you more services and advertising. Buy a Google phone and you hook directly into Google’s world. In ChromeOS the link is even more obvious, since you sign onto the computer with your online Google credentials.

The power shift is obvious. And as Tim O’Reilly implies in his excellent post, Google’s lack of legacy desktop baggage is helping it to compete against Apple as well as Microsoft.

Related posts:

1. Why it’s hard to compete with Apple in mobile app development and deployment
2. Fragmentation and the RIA wars: Flash is the least bad solution
3. Building for multiple mobile platforms with one codebase

Here’s a bit of speculation. Maybe Spotify benefited from the fallout over Apple’s rejection of the Google Voice application – though Apple says it “continues to study it”. The Google Voice move drew articles like Apple is growing rotten to the core from TechCrunch. The question for Apple: did it want another high-profile, self-interested app rejection while still fighting Google Voice?

A further consideration is that Spotify is a tiny company compared to Google; music download/streaming enterprises come and go, and Spotify has a tricky task ahead making its business model work, as Mark Mulligan observes. Further, there’s nothing to stop Apple launching its own streaming, subscription service if it chooses to do so.

If Apple felt it had to choose between the threat of Google Voice, and the threat of Spotify, it is easy to see why it would pick the latter.

It follows that if you want to get your difficult, might-compete-with-Apple app into App Store, you should:

1. Build a decent-sized community around your service first.

2. Make a lot of noise when you submit your app.

3. Make even more noise should Apple reject it (this did not apply to Spotify, but it has worked for others).

4. Choose a moment when Apple is already embroiled in App Store battles that are more important than yours.

Publicity makes all the difference.

With all this, will Spotify succeed? The service is fantastic, but I’m not sure about people’s willingness to add £10 per month to their already-expensive iPhone contracts. However, I still think what I have argued for years: that in the digital age, music subscription makes more sense than paid-for permanent downloads.

Related posts:

1. Spotify for iPhone looks great – if Apple allows it
2. Spotify demos mobile music streaming with offline option – for Android
3. Spotify is the new Napster

I tried this, and it is amazing, though you do need to subscribe to Napster; trial accounts are available. If I want to play any song or album in Napster’s vast library, I select Squeezenetwork as the music source on the Boom, select the Napster music service, search the Napster library, and play the music. No computer has to be running for this to work. Sound quality is good though noticeably worse than locally-streamed lossless FLAC; more radio than hi-fi.

I’ve also been spending time with Spotify. Like Napster, this makes a huge library available, plus it has a couple of advantages. Performance is better, with near-instant search results and playback; and best of all it is free, if you can tolerate occasional advertisements. Unfortunately Spotify does not integrate with Squeezebox yet, though users are clamouring for it.

The Squeezebox is a schizophrenic product with one foot in the old world of local media storage, and one foot in the new world of Internet streaming via Squeezenetwork. Squeezebox plus Napster is great; Squeezebox plus Spotify would be even better. Either one makes Apple’s iTunes purchase-and-download model look dated.

Related posts:

1. Logitech Squeezebox Radio has social features, unsocial price
2. Reviewing the Logitech Squeezebox Touch
3. Spotify is the new Napster

What is interesting to me is the article neglects to look at what Microsoft is doing with Zune in regards to DRM. Just like Apple and Amazon – the Zune Marketplace also offers DRM-free music.

According to this page on the Zune Marketplace:

Browse over three million songs you can preview and download—most are now available as MP3s that’ll play on your Zune device or any other MP3 player. Or get an instant music collection: Zune Pass gets you millions of downloads for just $14.99 a month.

Answering LeBlanc, one reason is that Microsoft has not made Zune available internationally, so its visibility in the UK is rather minimal. Nevertheless, the Zune developments are interesting. In fact, the Zune now has pretty much the business model many expect Apple’s iTunes and iPod/iPhone to have in the future – all-you-can-eat subscription, with a premium download option.

Still, Microsoft has a marketing problem with Zune. First, it’s perceived as a me-too answer to iTunes/iPod. Second, the branding is focused firmly on the Zune device, which has only a small market share. Amazon on the other hand makes great play of the iPod compatibility of its MP3 store. How can Microsoft promote Zune marketplace as a source for DRM-free iPod music, without undermining the whole Zune concept in which device and store are tied tightly together?

Related posts:

1. Wired votes for Zune over iPod
2. Customer complains about iTunes DRM, gets refund
3. Amazon and the future of music downloads

IN 2006 EMI, the world’s fourth-biggest recorded-music company, invited some teenagers into its headquarters in London to talk to its top managers about their listening habits. At the end of the session the EMI bosses thanked them for their comments and told them to help themselves to a big pile of CDs sitting on a table. But none of the teens took any of the CDs, even though they were free. “That was the moment we realised the game was completely up,” says a person who was there.

Related posts:

1. XNA, XBox 360 and the decline of computer science
2. Microsoft quarterly results: server and tools shine, overall decline
3. Spotify for iPhone looks great – if Apple allows it

The Viewty is bound to be compared to the iPhone, because both have touch screens. The Viewty is cheaper and has more features (though it is missing a few as well), but to my mind its biggest handicap is that it lacks the polish and attention to detail which typifies Apple’s products.

Back in 2004 I reviewed the iRiver H140, a great MP3 player that was superior to Apple’s iPod in several respects. It had both digital input and output. It had a better battery. It had FM radio. It had a remote with controls and an LCD display. It had a built-in microphone and a mic input – I still use it for recording today.

The H140 was a modest success, but nothing in comparison to the mighty iPod. Why? It wasn’t just the marketing, or the looks, though both were factors. Another issue was that the H140 and its successor the H320 have perplexing controls that almost seem designed to catch you out. The iRiver also came with PC software that didn’t seem to do anything at all, though in fact it inserted some right-click options into Windows Explorer. It was a far cry from the slick iTunes/iPod integration.

The Viewty pays more attention to usability than the H140, but there are enough niggles – like the dangling stylus holder, the awkward jog wheel, or the error-prone LG PC Suite – that you wonder if these lessons have been learned.

On the positive side, the Viewty is an excellent phone, camera, and portable entertainment device. It proves that the Flash UI concept works, and that the day will come when I no longer need to take a standalone camera to conferences and the like – paying attention, Canon?

PS does anyone know how to take screen grabs from the Viewty? If I can figure it out, I’ll post some examples of the UI.

Related posts:

1. The sad story of the LG Viewty – case study in Web 2.0 failure
2. The backward march of iPod/MP3 devices
3. Comparing digital snaps on a new camera and one five years old

The good news is that apparently the hash has been cracked, “using a debugger on Windows.”

Miguel de Icaza goes on to observe:

Breaking the hash is not really a long-term solution, as they can keep making the process harder every time. The long-term solution is for iPods to have a standard interface that third parties can communicate with.

Indeed. Of course, if iTunes and iPod communicated through a standard API, and if Apple would license its DRM or support alternatives, then any hardware vendor could sell iPod-compatible hardware, any software vendor could come up with substitutes for iTunes, and any online music store could compete with Apple’s official one.

Commoditization. Something Apple will do anything to avoid.

Related posts:

1. New iPod locked more tightly to iTunes, will not work with Linux
2. Review: Sansa’s iPod alternative
3. Apple’s iPod Touch gaming device

I wrote a piece a while back on Linux multimedia, and was impressed at how well my old iPod Photo works with Amarok on Linux. I have this iPod formatted for the Mac, since iTunes seems to work better on OS X. The only change I needed was to turn off journalling on the HFS+ file system. So what’s happened now?

According to this post, Apple has encrypted the iPod’s database. If you write to the database other than with iTunes, the iPod firmware will report that it is empty.

How about replacing the firmware completely, say with Linux? Bad news there as well – Apple has encrypted the firmware too. See ipodlinux.org for more details. In consequence, you can only hack the firmware on older models.

The change to the song database is more significant. Only a tiny geek minority would be willing to replace their firmware, but there are more people who like the the iPod but not iTunes. This may be damaging for third parties like J River, which offers iPod-compatible media center software.

See also Mike Elgan’s article on Is Apple the New Microsoft; and also note how the piece has over 1000 “Do not Recommend this story” votes from enraged Apple enthusiasts.

There is also a discussion on slashdot.

Update: more commentary from Miguel de Icaza (of GNOME, Mono fame) and Cory Doctorow – the usual suspects, I guess. “This has nothing to do with preventing piracy — this is about preventing competition with the iTunes Store,” says Doctorow.

Related posts:

1. iPod database successfully hacked – for now
2. Customer complains about iTunes DRM, gets refund
3. Wired votes for Zune over iPod